setting up a dmz node without a gateway

descr

note we’re using kvm for this poc hence the 192.168.122.0/24 subnet instead of public addresses.

all the tests have been automated as an ansible playbook

setup

host config

we need two bridges for this poc. the default one is already up

brctl show virbr0
ifconfig virbr0

the internal one we need to build

brctl addbr dummybr0
ifconfig dummybr0 up

guest skeleton

vi slack-1.xml

<interface type='bridge'>
  <source bridge='dummybr0'/>
  <model type='virtio'/>
</interface>

vi slack-2.xml

<interface type='bridge'>
  <source bridge='virbr0'/>
  <model type='virtio'/>
</interface>
<interface type='bridge'>
  <source bridge='dummybr0'/>
  <model type='virtio'/>
</interface>

guest network setup

slack-1,3 (behind nat)

echo -n eth0 ...
ifconfig eth0 10.1.1.1/24 up && echo done
#ifconfig eth0 10.1.1.3/24 up && echo done

echo no default route - dnat only
route -n | grep ^0.0.0.0 && route delete default

slack-2 (nat gw)

echo -n eth0 ...
ifconfig eth0 192.168.122.102/24 up && echo done

echo -n eth1 ...
ifconfig eth1 10.1.1.2/24 up && echo done

echo -n default route ...
route add default gw 192.168.122.1 && echo done

# self-verbose
sysctl -w net.ipv4.ip_forward=1

echo -n nftables ...
nft -f /etc/nftables.conf && echo done

see https://ansible.nethence.com/infra/test_stateless_nat/templates/rc.inet1

inbonud full-nat with states OK

states in both directions (full-nat)

here’s the translation on the way in

1.2.3.4:1024 ==>  4.3.2.1:22
10.1.1.2:1024 ==> 10.1.1.1:22

and the answer goes

10.1.1.1:22 ==> 10.1.1.2:1024
 4.3.2.1:22 =(state)=> 1.2.3.4:1024

one-to-one see https://ansible.nethence.com/infra/test_stateless_nat/templates/nftables.fulldnat.conf

check

from workstation

nmap -p 22 192.168.122.102
ssh 192.168.122.102 -l root -p 22 hostname

one-to-many see https://ansible.nethence.com/infra/test_stateless_nat/templates/nftables.fulldnat-many.conf

check

from workstation

nmap -p 2201 192.168.122.102
nmap -p 2203 192.168.122.102
ssh 192.168.122.102 -l root -p 2201 hostname
ssh 192.168.122.102 -l root -p 2203 hostname

inbound full-nat without states NOK

here’s the translation on the way in

1.2.3.4:1024 ==>  4.3.2.1:22
10.1.1.2:1024 ==> 10.1.1.1:22

and the answer goes

10.1.1.1:22 ==> 10.1.1.2:1024
 4.3.2.1:22 ==> ????????:1024

==> packet gets lost without a table to keep track of the originating external source IP

resources

https://pub.nethence.com/network/fuck-martinez-part3 ==> previous full-nat setup